11
$\begingroup$

In the 20th century, it was common for various intelligence agencies and military organizations to use ciphering machines and one-time pads.

However, no source I've seen ever mentions the process of generating the keys and printouts for such use.

  • Were there special machines for printing / punching them onto a card?

  • Where did the entropy they used come from?

  • Were there any significant breaches due to the bad randomness of the keys used?

$\endgroup$
7
$\begingroup$

Your interesting questions deserve to be answered more thoroughly, but here goes:

  1. According to a highly classified document that was written in 1947 and finally declassified in 2013, the Germans started using a one-time pad system for diplomatic traffic in 1925. This system (GEE) used a one-time pad of digits to encrypt codes by modulo addition. To be clear, these codes, from a large code book, stood for names, numbers, grammatical features of German, dates, places, objects, etc. GEE traffic was first intercepted in 1934. That was good for the Allies because World War II in Europe was around the corner, and keys for the GEE system were being generated by a complex mechanical device that was not cryptographically secure.

    The German additive generator of wheels and switches had weaknesses which were brilliantly exploited by American analysts: the phases, cycles, potential overlaps, and limits of the keys became clear after exhaustive analysis of captured GEE one-time pads. By 1 March, 1945, the U.S. was breaking GEE traffic because the German machine did not create truly random numbers--the Americans were able to create a mirror machine based on key periodicity, other weaknesses, etc.

    The released document (PDF) says that the GEE keys

    …could be predicted in full upon partial recovery through cribs and superimposition to give a new kind of overlap.

    Breaking GEE allowed the U.S. access into German diplomatic traffic at the end of the war, especially their dealings with Japan. (See the interesting reference to uranium in one pre-August 6, 1945 transmission.)

    Interestingly, the document says that the Germans could have easily defeated cryptanalysis by changing the set-up of the 240 wheels in the machine, but they never did! The Germans produced enormous amounts of key material without altering the basic set-up of the device. This led to “ample homogeneous material” being produced.

  2. During the Cold War, the Soviets were known to generate one-time pads by having rooms full of typists peck away randomly. Not truly random, but still formidable because such results are--as another writer said--from different people, and can be further obfuscated. For those who disparage one-time pads, consider this: at the NSA people refer to the day when the Soviets starting using one-time pads in “...all high-level Soviet communications, including the mainline military, air force, and navy nets” for radio traffic--October 29, 1948--as Black Friday. (See: The National Cryptologic School's "On Watch", 9-86) Nevertheless, there are instances in which key weakness helped exploit key misuse during the Cold War.

  3. Early U.S. efforts to generate random numbers and marry those to plaintext (Telektypton, 1933) depended on a typist and keyboard, a natural but faulty way to think about the problem. It should be mentioned that the Telekrypton had other weaknesses, such as a looped keystream. What is so interesting about Telekrypton is that it was widely used, highly regarded, and deeply flawed. After World War II the idea to use noise for entropy in key generation was made and put to use by British Intelligence. The man who figured this out retired from GCHQ in the 1980's. The generator based on his ideas has been regarded as the first to generate truly random keys.

$\endgroup$
  • $\begingroup$ The Soviet method sounds like the best of those three. $\endgroup$ – Melab Feb 3 '18 at 17:13
2
$\begingroup$

If you consider that the quality of randomness can only be assessed in proportion to the size of the data sample, you'll realise that it's not really that hard to make random numbers. Depending of course on how many you want. You have to change mindset from today. One time pads were not (and should not be) used to encrypt a 6TB hard drive's worth of porn.

I think in the early days, WW1ish time, they were made by ladies randomly typing at typewriters. If a pad's page only contains 250 numbers, that can be fairly easily be bashed out on a manual keyboard. If different individuals produce different pages, that should even out unconscious patterns. I've read this somewhere but can't find a reference. But if you try it yourself, you'll see it's easy. And how can you disprove the randomness of 250 characters that were typed randomly on purpose? You can't as historical archives show.

Later they had electro-mechanical randomising devices using a rotating cam timed with relaxation oscillators. This relies on contact bounce which is fairly random, and produced numbers at 35 baud. There's also a funky rotating disc device that I only have on my machine, so the following is an extract:-

disc

Later during the SIGSALY days, vacuum tube diodes were used to create electrical noise which was then digitised. These (KS-3 and KW-7) devices ran at up to 100 kbaud. Here's another extract from A History of U.S. Communications Security (Volumes I and II); the David G. Boak Lectures, National Security Agency (NSA), 1973:-

randomiser

And whist the British Post Office is not the NSA, there's ERNIE which is a Premium Bond picker outer machine device thing. He's moved on now to solid state diodes, but ERNIE 1 (1956) did it with these valves:-

ERNIE

V1 is the noisy valve. The KS-3 and KW-7 will have used a very similar circuit. Interestingly, we still use the same circuit today. We just swap the vacuum tubes for transistors.

I'm not aware of any security breaches of a OPT other than the breaking of the GEE German Diplomatic code during WW2. All of the documented instances like (Venona) relied upon duplicated key material, not poor entropy from the typist. The proof of this is that no OTPs prior to the pad duplication mistake in 1942 have been decrypted.

$\endgroup$

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.